crytic / crytic/slither

Detectors related to improper usage of Oracle APIs

Open
#2,283 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

Hello folks,

I am working on a bachelor's thesis related to smart contract security. My goal is to use static analysis to detect improper usage of Oracle APIs and, therefore, prevent possible vulnerabilities. I have created a few detectors in Slither, currently focusing on Chainlink data validation. I plan to support other Oracles and generalise the detectors, if possible.

The code is available here (it's a clone, not a fork of Slither at the moment): [`repository`](https://github.com/talfao/slither-detection/tree/dev). To see what gets detected, you can check the [`tests`](https://github.com/talfao/slither-detection/blob/b3e798eaf60925b3a656312e3bab65f798b2932e/tests/e2e/detectors/test_detectors.py#L1683-L1688). For example when calling [`priceFeed.latestRoundData()`](https://github.com/talfao/slither-detection/blob/b3e798eaf60925b3a656312e3bab65f798b2932e/tests/e2e/detectors/test_data/oracle-data-validation/0.8.20/oracle_data_check_price_in_internal_fc.sol#L61), the return value price should be checked:
```solidity
(
uint80 roundID,
int256 price,
,
uint256 updatedAt,
uint80 answeredInRound
) = priceFeedDAIETH.latestRoundData();

require(price_check(price));
require(updatedAt - block.timestamp < 500);
require(answeredInRound > roundID);

```
Omitting such a check can lead to potentially serious issues if the oracles provide incorrect data. The [`detector`](https://github.com/talfao/slither-detection/blob/b3e798eaf60925b3a656312e3bab65f798b2932e/slither/detectors/oracles/oracle_data_validation.py#L89) checks whether the price-check is present.

Would you be interested in such a type of detector in Slither? It does not detect Solidity/Vyper syntax-related bugs but could be a valuable detector anyway. Maybe running such a detector could be hidden behind a feature flag.

I am looking forward to hearing any feedback from you on both the code and the idea of such detectors. Also, I am more than happy to improve/refactor the code to fit Slither better.

Cheers, Talfao

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.